topic Re: CentOS 6 server Syslog forwording to Splunk server in Getting Data In

CentOS 6 server Syslog forwording to Splunk server

heykumaran — Thu, 11 Jul 2013 16:19:32 GMT

Hello,

How can i forward syslog from one of our servers (CentOS 6.3) to Splunk Server (Windows 2012). Please help me

Thanks

jtrucks — Thu, 11 Jul 2013 16:27:00 GMT

You can have Splunk listen for this data like this:

Manager -> Data inputs -> TCP -> Add new

Choose a TCP port, allow all hosts or restrict to a single host.
Set sourcetype to syslog on the bottom drop list.

If you want to point it at the non-default index, choose More settings and pick an index.

Click save and make sure your network and host firewalls allow the traffic.

heykumaran — Thu, 11 Jul 2013 16:32:40 GMT

Thanks..do i have to do any configuration in CentOS Server side to point to Splunk server

jtrucks — Thu, 11 Jul 2013 16:39:51 GMT

Yes, you must tell the CentOS machine to send logs off host. Assuming it is rsyslog, read these docs:

You could, also, set the Splunk Data input as UDP not TCP and use this method:

jtrucks — Thu, 11 Jul 2013 16:40:30 GMT

Please mark Answered if this does solve your issue, too. thanks 🙂

nilesh8 — Fri, 16 Aug 2013 15:22:12 GMT

Hi,

Could you tell TCP port number for the same.

yannK — Fri, 16 Aug 2013 16:13:08 GMT

The port number is the on you defined yourself in the inputs.conf of your indexer. (or using the manager).

usually syslog servers use 514 UDP, but you can specify any.